CVE-2021-20663: XSS
Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-20663?
CVE-2021-20663 is classified as a high severity cross-site scripting vulnerability.
What versions are affected by CVE-2021-20663?
CVE-2021-20663 affects Movable Type 7 prior to r.4705, Movable Type Advanced 7 prior to r.4705, Movable Type 6.7.5 and earlier, and Movable Type Premium 1.39 and earlier.
How do I fix CVE-2021-20663?
To fix CVE-2021-20663, upgrade to Movable Type version 7 r.4706 or later, Movable Type Advanced version 7 r.4706 or later, and ensure you are using Movable Type 6.8 or later.
What is the impact of CVE-2021-20663?
The impact of CVE-2021-20663 allows attackers to execute arbitrary JavaScript code in the context of another user’s session.
How did CVE-2021-20663 get discovered?
CVE-2021-20663 was discovered during regular security assessments and vulnerability testing of the Movable Type platform.